io.pkts.packet

Interface Packet

All Superinterfaces:

Cloneable

All Known Subinterfaces:

ApplicationPacket, IPPacket, IPv4Packet, IPv6Packet, MACPacket, PCapPacket, RtcpPacket, RtpPacket, SctpPacket, SDPPacket, SipPacket, SipRequestPacket, SipResponsePacket, TCPPacket, TransportPacket, UDPPacket, UnknownApplicationPacket

All Known Implementing Classes:

AbstractApplicationPacket, AbstractPacket, IPv4PacketImpl, IPv6PacketImpl, MACPacketImpl, PCapPacketImpl, RtcpPacketImpl, RtpPacketImpl, SctpPacketImpl, SDPPacketImpl, SipPacketImpl, SipRequestPacketImpl, SipResponsePacketImpl, TcpPacketImpl, TransportPacketImpl, UdpPacketImpl, UnknownApplicationPacketImpl

public interface Packet
extends Cloneable

Represents a captured packet.

Author:

jonas@jonasborjesson.com

Method Summary

Modifier and Type	Method and Description
Packet	clone()
long	getArrivalTime() The arrival time of this packet in microseconds relative to epoch (midnight UTC of January 1, 1970).
String	getName() Get the name of the packet.
Packet	getNextPacket() Get the next frame, or null if there is none.
Packet	getPacket(Protocol p) Find the packet for protocol p.
Packet	getParentPacket() Almost all packets have a parent, which is the encapsulating protocol.
Buffer	getPayload() Get the payload of the frame.
Protocol	getProtocol() Get the protocol of this frame.
boolean	hasProtocol(Protocol p) Check whether this packet contains a particular protocol.
void	verify() Calling this method will force the packet to completely parse its data and check so that all the information conforms to whatever rules this packet needs to follow.
void	write(OutputStream out) Write this packet to the OutputStream.
void	write(OutputStream out, Buffer payload) Writes this packet to the OutputStream with the supplied payload.

Method Detail

getArrivalTime

long getArrivalTime()

The arrival time of this packet in microseconds relative to epoch (midnight UTC of January 1, 1970). Note, since this returns with microseconds precision (which may or may not be relevant depending on the hardware on which the packet was captured on) and you wish to format this arrival time into a more human readable format you could use the SimpleDateFormat but it can only handle milliseconds precision (you will have to write your own date formatter if you want microseconds). Here is a snippet illustrating how to turn the arrival time of the packet into a human readable date

 Packet p = ...;
 SimpleDateFormat formatter = new SimpleDateFormat("yyyy.MM.dd HH:mm:ss.SSS");
 Date date = new Date(p.getArrivalTime() / 1000);
 System.out.println("Arrival time: " + formatter.format(date));
 

Note how an integer devision is performed on the arrival time to "cut off" the microseconds from the time stamp

Returns:

the arrival time of the packet in microseconds since the start of the epoch

verify

void verify()

Calling this method will force the packet to completely parse its data and check so that all the information conforms to whatever rules this packet needs to follow. E.g., if this happens to be a SIP packet, then it will check if it has the mandatory headers etc. Some simpler packets, such as the IPPacket, hardly does anything in this method but more complex protocols such as SIP (once again), HTTP etc can spend quite some time verifying everything, which is why you don't want to do it unless you really have to. In general, yajpcap has the philosophy of "assume that everything is ok until things blow up and then deal with it"

write

void write(OutputStream out)
    throws IOException

Write this packet to the OutputStream. Typically, the OutputStream would be a PcapOutputStream so when writing packets to this stream they will still be a valid pcap.

Parameters:

out -

Throws:

IOException

write

void write(OutputStream out,
           Buffer payload)
    throws IOException

Writes this packet to the OutputStream with the supplied payload. You can use this method to e.g. write a raw UDPPacket to the stream with this payload. Note, if the UDPPacket already had a payload it will be ignored so use this method with care.

Parameters:

out -

payload -

Throws:

IOException

clone

Packet clone()

hasProtocol

boolean hasProtocol(Protocol p)
             throws IOException

Check whether this packet contains a particular protocol. This will cause the packet to examine all the containing packets to check whether they are indeed the protocol the user asked for.

Parameters:

p -

Returns:

Throws:

IOException - in case something goes wrong when framing the rest of the protocol stack

getProtocol

Protocol getProtocol()

Get the protocol of this frame.

Returns:

getPacket

Packet getPacket(Protocol p)
          throws IOException,
                 PacketParseException

Find the packet for protocol p.

Parameters:

p -

Returns:

the packets that encapsulates the protocol or null if this protocol doesn't exist

Throws:

IOException - in case something goes wrong when framing the rest of the protocol stack

PacketParseException - if the next packet can't be parsed by the framer

getName

String getName()

Get the name of the packet. Wireshark will give you a short description of all the known protocols within its "super" packet. E.g., if you "click" on the Pcap Frame it will have a field called "protocols in frame" and will display something like "eth:ip:udp:sip:sdp", this function will return a short name like that.

Returns:

getNextPacket

Packet getNextPacket()
              throws IOException,
                     PacketParseException

Get the next frame, or null if there is none. Note, if there isn't another frame but there is still raw data within this frame, it only means that we didn't recognize the payload.

Returns:

Throws:

IOException

PacketParseException - if the next packet can't be parsed by the framer

getParentPacket

Packet getParentPacket()

Almost all packets have a parent, which is the encapsulating protocol. E.g., the parent of a SipPacket is typically a TransportPacket such as UDPPacket or a TCPPacket. The parent of a TransportPacket is usually a IPPacket and so on.

Returns:

getPayload

Buffer getPayload()

Get the payload of the frame. If null, then this frame doesn't have any payload

Returns: